CVE-2025-43703

Anki (Ankitects) up to version 25.02 is affected by CVE-2025-43703, which allows attacker-controlled access to the internal API via a crafted shared deck, even without knowledge of an API key. The issue stems from an incomplete fix for CVE-2024-32484 and can be triggered through methods such as s...

CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API even though the attacker has no knowledge of an API key through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists...

CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API even though the attacker has no knowledge of an API key through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists...

CVE-2025-43703

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API even though the attacker has no knowledge of an API key through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists...

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet Access Points (AP) models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial Wireless 3700, is related to incomplete resource cleanup. This vulnerability allows a malicious actor to trigger service failures.

The vulnerability of microprogrammed routing devices with integrated networking services from Cisco ISR 800 and Cisco ISR 1900, microprogrammed access points from Cisco Aironet models 1530, 1552, 1570, 1700, 2700, 3700, and microprogrammed wireless industrial access points from Cisco Industrial...

Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability

Talos Vulnerability Report TALOS-2024-2098 Eclipse ThreadX NetX Duo HTTP server denial of service vulnerability April 14, 2025 CVE Number CVE-2025-2260,None SUMMARY A denial of service vulnerability exists in the NetX HTTP server functionality of Eclipse ThreadX NetX Duo git commit 6c8e9d1. A...

The vulnerability of the afs_put_server() function in the fs/afs/server.c module of the Andrew file system support module for Linux kernel allows a hacker to cause a service failure.

The vulnerability of the afsputserver function in the fs/afs/server.c module of the Andrew file system support module in the Linux operating system is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause service failures...

golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

CVE-2025-1095

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation LPE. The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a l...

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise, related to the use of an incomplete blacklist, allows attackers to circumvent security restrictions.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of an incomplete blacklist. Exploiting this vulnerability could allow a hacker to bypass security restrictions...

CVE-2025-2260

In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error for each further file request. Users ca...

CVE-2025-1095

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation LPE. The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a l...

Ubuntu: Security Advisory (USN-6885-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-15442 · Ibm · Ibm Personal Communications

Name of the Vulnerable Software and Affected Versions: IBM Personal Communications versions 14 through 15 Description: The issue allows any interactively logged-in users on the target computer to run commands with full privileges in the context of NT AUTHORITYSYSTEM. This enables a low-privileged...

Incomplete List of Disallowed Inputs

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in scanner.py, which does not include timeit or other modules that can be leveraged for unintended command...

Incomplete List of Disallowed Inputs

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in scanner.py, which does not include ssl or other modules that can be leveraged for remote operations. An...

tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service DoS, causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak...

CVE-2025-2260

Summary: CVE-2025-2260 affects the NetX Duo HTTP server component in Eclipse ThreadX NetX Duo (netxduo) prior to 6.4.3. The root cause is a missing file close after an error during PUT handling, causing the server to respond with 404 for subsequent file requests. Affects both NetX Duo Web Compone...

[SECURITY] [DSA 5896-1] trafficserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5896-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 05, 2025 https://www.debian.org/security/faq -...

MinIO performs incomplete signature validation for unsigned-trailer uploads

Impact This is a high priority vulnerability and users must upgrade ASAP. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket, Prior...